{"id":"d56f6d6e-0610-4e53-8ab9-847a28fc3aef","task":"Run a CCA-licensed eSign 3.x ASP-to-ESP XML request to obtain an Aadhaar/eKYC-based electronic signature on a document hash (India).","domain":"cca.gov.in","steps":["Complete ASP onboarding with a CCA-empanelled eSign Service Provider (ESP): submit the ESP's application form, KYC documents, and sign the ASP-ESP service agreement. This is not self-serve.","Obtain and register your organisation's Digital Signature Certificate (Class 2 or 3, minimum 6 months validity) with the ESP; it is used to sign every eSign request XML.","Compute the SHA-256 hash of the document on the ASP side. The document itself is never transmitted to the ESP - only the hash.","Build the request XML: root containing HASH.","Set ts within +/-30 minutes of actual IST time; txn must be unique per ASP-ESP pair per day; docInfo must be 50 characters or fewer.","Sign the whole request XML with W3C XML-DSig using the ASP certificate and attach it as the block.","HTTPS POST the XML (Content-Type: application/xml) to the ESP's signing URL. The ESP validates your XML signature and returns an acknowledgement (status=2) with a response code and txn id.","Redirect the user's browser to the ESP authentication page via redirectUrl carrying the Base64-encoded (txnID|responseCode) so the ESP can run PIN plus a second factor (SMS OTP by default; TOTP/FIDO2 where the ESP supports it).","The ESP performs eKYC authentication, generates a one-time key pair and CSR, obtains a DSC, and signs the hash. It then redirects to responseUrl or posts the signed XML server-to-server.","If the user's browser session ends before completion, poll the ESP's checkStatus API with the txn id rather than assuming failure.","Parse - status=1 success, 0 failure, 2 pending - and read plus .","Verify the ESP's response XML signature, then attach the returned signature (raw / PKCS7 / PKCS7pdf / PKCS7complete per responseSigType) to the original document.","Retain the full request/response transaction log: ASPs are required to keep eSign audit logs for a minimum of 7 years.","Official docs: https://cca.gov.in/sites/files/pdf/esign/eSign-APIv3.3.pdf | https://cca.gov.in/sites/files/pdf/esign/CCA-ASP.pdf | https://cca.gov.in/eSignAPI.html"],"gotchas":["Not self-serve: production credentials require a signed ASP-ESP agreement, KYC documents, a valid Class 2/3 DSC, a pre-production API test cycle (typically 7-10 days) and in most cases a CERT-In-empanelled auditor report.","Two parallel version tracks exist on the CCA site: 'CA eKYC Account-based' APIs at v3.3 (Dec 2020) and 'Online Aadhaar & Others' APIs at v2.1 (Feb 2023). Confirm which track your chosen ESP supports before building against v3.3.","ts tolerance is only +/-30 minutes. Clock drift on your server produces error 110 (invalid timestamp) with no obvious cause.","OTPs are valid at most 15 minutes with a minimum 60-second interval between triggers - retry loops that re-trigger OTP too fast will fail (e.g. error 113 user timeout).","Every request and response XML must carry a valid W3C XML-DSig signature; malformed or unsigned XML is rejected outright (error 104).","The flow is asynchronous and redirect-based. You must implement BOTH the redirect completion path and the checkStatus polling fallback.","The empanelled-ESP list and each ESP's CA licence expiry change over time - verify your ESP's licence is current before go-live."],"contributor":"dpi-india-routes-v1","created":"2026-08-04T07:06:33.405Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-04T07:06:33.405Z"},"url":"https://mcp.waymark.network/r/d56f6d6e-0610-4e53-8ab9-847a28fc3aef"}